diff --git a/etc/di.xml b/etc/di.xml
index 4c071a9c..8995bbc0 100644
--- a/etc/di.xml
+++ b/etc/di.xml
@@ -1,9 +1,7 @@
 <?xml version="1.0"?>
 <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
-    <preference for="Tagging\GTM\Api\OrderCommentControllerInterface" type="Tagging\GTM\Controller\OrderCommentController"/>
     <preference for="Tagging\GTM\Api\CheckoutSessionDataProviderInterface" type="Tagging\GTM\SessionDataProvider\CheckoutSessionDataProvider"/>
     <preference for="Tagging\GTM\Api\CustomerSessionDataProviderInterface" type="Tagging\GTM\SessionDataProvider\CustomerSessionDataProvider"/>
-    <preference for="Tagging\GTM\Api\OrderNotesInterface" type="Tagging\GTM\Model\OrderNotes"/>
 
     <type name="Tagging\GTM\Logger\Debugger">
         <arguments>
diff --git a/view/frontend/templates/iframe.phtml b/view/frontend/templates/iframe.phtml
index b975a7d4..66067132 100644
--- a/view/frontend/templates/iframe.phtml
+++ b/view/frontend/templates/iframe.phtml
@@ -27,89 +27,11 @@ if ($config->isEnabled() && $config->getGoogleTagmanagerUrl() && strlen($config-
     <!-- External script - no CSP needed as it's whitelisted in csp_whitelist.xml -->
     <script defer src='https://<?= $config->getGoogleTagmanagerUrl() ?>/user-data-minified.es.js'></script>
     
+    <!-- Load main.js as external script using secure renderer -->
     <?php
-    // Main functionality script
-    $mainScript = <<<'SCRIPT'
-/**
- * Generate simple hash based only on items and quantities
- * @param {Object} eventData - GA4 event data
- * @returns {string} Base64 encoded hash
- */
-window.tagging_gtm_simple_hash = function(eventData) {
-    if (!eventData.ecommerce || !eventData.ecommerce.items) {
-        return '';
-    }
-
-    const parts = [];
-
-    // Add items and quantities
-    eventData.ecommerce.items.forEach(item => {
-        const itemId = item.item_id || '';
-        const quantity = item.quantity || 0;
-        parts.push(`i_id=${itemId}&qt=${quantity}`);
-    });
-
-    // Join all parts and encode to base64
-    const value = parts.join('&');
-    return btoa(value);
-}
-
-/**
- * Generate advanced hash based on items, quantities, and user agent
- * @param {Object} eventData - GA4 event data
- * @returns {string} Base64 encoded hash
- */
-window.tagging_gtm_advanced_hash = function(eventData) {
-    if (!eventData.ecommerce || !eventData.ecommerce.items) {
-        return '';
-    }
-
-    const parts = [];
-
-    // Add items and quantities
-    eventData.ecommerce.items.forEach(item => {
-        const itemId = item.item_id || '';
-        const quantity = item.quantity || 0;
-        parts.push(`i_id=${itemId}&qt=${quantity}`);
-    });
-
-    // Add user agent (normalized: lowercase, spaces removed)
-    const userAgent = navigator.userAgent || '';
-    const normalizedUserAgent = userAgent.toLowerCase().replace(/\s+/g, '');
-    parts.push(`--ua=${normalizedUserAgent}`);
-
-    // Join all parts and encode to base64
-    const value = parts.join('&');
-    return btoa(value);
-}
-
-window.tagging_gtm_save_hash = function(hash, marketingObject) {
-    if (!hash || !marketingObject) {
-        console.error('Hash or marketingObject is missing');
-        return;
-    }
-
-    fetch(window.tagging_proxy_domain + "/_tools/kv/" + hash, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-            value: marketingObject,
-        }),
-    })
-    .then(() => {
-        return;
-    })
-    .catch((err) => {
-        console.error(`Error sending data to API`, err);
-    });
-}
-SCRIPT;
-    
     if ($isHyva): ?>
-        <script><?= $mainScript ?></script><?php $hyvaCsp->registerInlineScript() ?>
+        <script><?= $block->getViewFileUrl('Tagging_GTM::js/main.js') ?></script><?php $hyvaCsp->registerInlineScript() ?>
     <?php else:
-        echo $secureRenderer->renderTag('script', ['type' => 'text/javascript'], $mainScript, false);
+        echo $secureRenderer->renderTag('script', ['type' => 'text/javascript', 'src' => $block->getViewFileUrl('Tagging_GTM::js/main.js')], '', false);
     endif;
 endif; ?>
\ No newline at end of file
diff --git a/view/frontend/web/js/main.js b/view/frontend/web/js/main.js
new file mode 100644
index 00000000..a8905c42
--- /dev/null
+++ b/view/frontend/web/js/main.js
@@ -0,0 +1,75 @@
+/**
+ * Generate simple hash based only on items and quantities
+ * @param {Object} eventData - GA4 event data
+ * @returns {string} Base64 encoded hash
+ */
+window.tagging_gtm_simple_hash = function(eventData) {
+    if (!eventData.ecommerce || !eventData.ecommerce.items) {
+        return '';
+    }
+
+    const parts = [];
+
+    // Add items and quantities
+    eventData.ecommerce.items.forEach(item => {
+        const itemId = item.item_id || '';
+        const quantity = item.quantity || 0;
+        parts.push(`i_id=${itemId}&qt=${quantity}`);
+    });
+
+    // Join all parts and encode to base64
+    const value = parts.join('&');
+    return btoa(value);
+}
+
+/**
+ * Generate advanced hash based on items, quantities, and user agent
+ * @param {Object} eventData - GA4 event data
+ * @returns {string} Base64 encoded hash
+ */
+window.tagging_gtm_advanced_hash = function(eventData) {
+    if (!eventData.ecommerce || !eventData.ecommerce.items) {
+        return '';
+    }
+
+    const parts = [];
+
+    // Add items and quantities
+    eventData.ecommerce.items.forEach(item => {
+        const itemId = item.item_id || '';
+        const quantity = item.quantity || 0;
+        parts.push(`i_id=${itemId}&qt=${quantity}`);
+    });
+
+    // Add user agent (normalized: lowercase, spaces removed)
+    const userAgent = navigator.userAgent || '';
+    const normalizedUserAgent = userAgent.toLowerCase().replace(/\s+/g, '');
+    parts.push(`--ua=${normalizedUserAgent}`);
+
+    // Join all parts and encode to base64
+    const value = parts.join('&');
+    return btoa(value);
+}
+
+window.tagging_gtm_save_hash = function(hash, marketingObject) {
+    if (!hash || !marketingObject) {
+        console.error('Hash or marketingObject is missing');
+        return;
+    }
+
+    fetch(window.tagging_proxy_domain + "/_tools/kv/" + hash, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            value: marketingObject,
+        }),
+    })
+    .then(() => {
+        return;
+    })
+    .catch((err) => {
+        console.error(`Error sending data to API`, err);
+    });
+}